CVE-2024-41811: 
PHP vulnerability analysis and mitigation

CVE-2024-41811 affects ipl/web, a set of common web components for PHP projects. The vulnerability was discovered in certain recent developments by Icinga, which are susceptible to Cross-Site Request Forgery (CSRF) attacks. The affected products include Icinga Web (>=2.12.0), Icinga DB Web (>=1.0.0), Icinga Notifications Web (>=0.1.0), and Icinga Web JIRA Integration (>=1.3.0) (GitHub Advisory).

The vulnerability is classified as a Cross-Site Request Forgery (CWE-352) with a CVSS v3.1 base score of 3.9 (Low). The vulnerability has the following vector string: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L, indicating that it requires network access, has high attack complexity, requires high privileges, and needs user interaction. The impact levels for confidentiality, integrity, and availability are all rated as Low (GitHub Advisory).

The vulnerability affects multiple Icinga products and could potentially allow attackers to perform cross-site request forgery attacks. The impact is considered Low across all three security metrics: confidentiality, integrity, and availability (GitHub Advisory).

The vulnerability has been fixed in version 0.10.1 of ipl/web, which is included as part of the icinga-php-library v0.14.1 release. All affected products will be protected from this vulnerability once the icinga-php-library is upgraded to this version (GitHub Advisory).